In a move to protect citizens’ data, Norway’s data protection authority has called for the extension of a ban on Meta’s consentless tracking ads across the European Union (EU). The authority has asked for a binding decision from the European Data Protection Board (EDPB) to make the emergency sanction, which prohibits Facebook and Instagram from tracking and profiling users for ad targeting without their consent, permanent and applicable throughout the EU. This could potentially result in a complete ban on Meta running tracking ads without consent across the EU single market. Meta, formerly known as Facebook, has the option to switch to asking users for permission to run personalized ads or face possible enforcement actions.

Norway’s data protection authority asks EU regulator to extend ban on Meta’s consentless tracking ads

Norway’s data protection authority, the Datatilsynet, has taken a significant step in protecting citizens’ data from Facebook and Instagram tracking and profiling without consent. The authority has requested that the European Data Protection Board (EDPB) impose a binding decision on Meta, the parent company of Facebook, to extend the ban on consentless tracking ads across the entire EU single market, rather than just locally. The EDPB has the power to impose a blanket ban on Meta running tracking ads without consent if it deems the action necessary. This move by the Norwegian DPA aims to safeguard web users’ privacy and prevent the normalization of consentless tracking across the industry.

Current Situation

In July, the Norwegian DPA issued a local ban on Meta tracking and profiling users without their consent. Despite the ban, Meta has continued to ignore the authority’s order and sought a court injunction against it. However, an Oslo court has recently rejected Meta’s arguments, affirming the DPA’s right to take action. In addition, the EDPB has already made a binding decision regarding Meta ads.

Norwegian DPA’s Request

The Datatilsynet has made a formal request to the EDPB for a binding decision to extend the ban on Meta’s consentless tracking ads across the EU single market. The aim of this request is to protect citizens’ data from being tracked and profiled by Facebook and Instagram without their consent. The request highlights the urgency of the situation and seeks to ensure that users’ privacy rights are upheld.

Potential Consequences

If the EDPB agrees with the Norwegian DPA’s request, it may impose a blanket ban on Meta running tracking ads without consent across the entire EU single market. This would have significant implications for Meta’s advertising practices and may require the company to switch to asking users for permission to run personalized ads. The action taken by the Norwegian DPA could potentially lead to a paradigm shift in the industry, with the normalization of consent-based tracking becoming the standard.

Legal Basis Challenges

Meta initially claimed contractual necessity as the legal basis for running tracking ads. However, the EU’s top court ruled in July that Meta cannot claim legitimate interest without user consent. In response to this ruling, Meta announced its intention to legalize its tracking ads business by asking users for their permission. However, the company has not yet implemented this change and continues to run unlawful tracking ads. The legal basis challenges faced by Meta highlight the importance of obtaining user consent for targeted advertising.

Response from Meta

Meta has expressed surprise at the actions taken by the Norwegian DPA. The company claims to be in active discussions with relevant data protection authorities, including the Irish Data Protection Commission, which is Meta’s lead regulator for GDPR enforcement. While Meta has committed to moving to the legal basis of consent for advertising in the EU/EEA, it has not provided a specific timeframe for when this transition will occur. The company’s blog post suggests that it intends to switch to consent-based advertising in the future but does not commit to a fixed date.

Implications for Meta

If the ban on Meta’s consentless tracking ads is extended across the EU single market, the company may need to fulfill its pledge to ask users for permission sooner than anticipated. Meta has employed PR tactics to retain some control over the situation and normalize the delay in implementing consent-based advertising. However, the paradigm shift in the company’s privacy-hostile business model appears inevitable, particularly in a major international region where the ban is enforced.

Enforcement by Irish DPC

The Irish Data Protection Commission (DPC) serves as the lead regulator for GDPR enforcement for Meta. However, if the Irish DPC is too slow in rectifying Meta’s lack of consent, the EDPB has the authority to intervene. EU citizens within the single market may have to rely on the Irish DPC to enforce their privacy rights, but the referral to the EDPB provides an alternative option for resolving the issue.

Conclusion

The actions taken by Norway’s data protection authority to extend the ban on Meta’s consentless tracking ads demonstrate a commitment to protecting web users’ privacy. The request for a binding decision from the EDPB and the potential blanket ban on tracking ads without consent across the EU single market highlight the importance of obtaining user consent for targeted advertising. Meta’s response and the implications for their advertising practices indicate a potential paradigm shift in the industry. It is now up to the EDPB to assess the request from the Norwegian DPA and play a crucial role in enforcing privacy rights for EU citizens.